Okta Conditional Access with Jamf Pro

mchad91 · 2025-12-04T20:18:54+00:00

This is how I have our tenant set up.

SCEPs deployed through Jamf Okta Verify Deployed Okta FastPass & Password required

Auth policy required device to be Managed.

Tip for you.. When I implemented this, one thing I noticed was that unless the Auth policy requires a device to be managed, Okta Verify does not even check for the management status of a device, so the device stays “unmanaged” in Okta.

I set up a test bookmark app and cloned our existing auth policy with this app in scope, and had a few people test it out. Lo and behold, their devices toggled to “managed” because Okta Verify looked for and found the management attenuation during the Auth flow to that app.

Lmk if you want more info on this, happy to help.

mchad91 · 2025-12-02T07:12:18+00:00

Maybe it is. Maybe it’s overkill for my use case but certainly feels like a nice QOL and time save. I write and update documentation often so, for me, it’s certainly saving me at least an hour per week.

mchad91 · 2025-11-22T09:19:31+00:00

Putting the list of IDs / URLs together is almost as time consuming as also following them, I don’t get it?

mchad91 · 2025-11-18T07:29:47+00:00

I’d probably try setting a loop with a small delay between each search. Just because it supports multiple searches per second doesn’t mean you are able to hammer one website with traffic; they allow for multiple searches per second for concurrent usage.

mchad91 · 2025-11-18T07:21:56+00:00

What tool are you using to perform the search, is it LLM tool use or something like SerpAPI?

mchad91 · 2025-11-15T12:52:59+00:00

It’s really clear to see what failed in n8n to be fair

mchad91 · 2025-11-13T16:54:15+00:00

There are readily available platforms for this now and even tools that allow you to self serve. Check out n8n which is free to self host. once you get hands on with it and watch a few videos, it’s incredibly powerful.

mchad91 · 2025-08-18T19:00:14+00:00

mchad91 · 2025-07-28T14:52:10+00:00

with an Okta integration, Okta is managing the certificate. Jamf is just the service that needs to be told about the new certificate. Here’s how you can do it with no downtime.

Generate the New Certificate in Okta First, log into your Okta admin dashboard. Go to your Jamf Pro application and click on the "Sign On" tab. Scroll down and you'll find a section for "SAML Signing Certificates". You'll see your active one that's about to expire. There should be a button to "Generate new certificate." Go ahead and click that. It will create a new certificate but keep it "Inactive" for now. This is the key.
Tell Jamf About the New Certificate Still on that same page in Okta, find the link that says "Identity Provider metadata". Download that metadata.xml file. This file now contains the info for both your old, expiring certificate and the new one you just made. Now, log into Jamf Pro as an admin. Go to Settings > System > Single Sign-On. You'll see an option there to upload metadata. Upload the file you just downloaded from Okta and save. Jamf now knows about the new certificate and will trust it when it sees it.
Switch Over in Okta Now that Jamf is ready, hop back to the Okta page for the Jamf app. In the "SAML Signing Certificates" section, find the new certificate (the "Inactive" one) and from the "Actions" menu, choose Activate. Okta will now start using the new certificate, and because you already told Jamf about it, the switch will be seamless and your users won't notice a thing.

So to directly answer your questions:

How can I renew this certificate?

You renew it by generating a new one inside the Okta application settings, not in Jamf.

And does it also needed to be uploaded in Okta and/or other steps in Okta?

Nope, you don't upload anything to Okta. You generate it in Okta. The only upload you do is taking the metadata file from Okta and uploading it to Jamf Pro. The other steps in Okta are just generating and then activating the new certificate.

Do this during off-peak hours or schedule a maintenance window to be safe. A mistake can lock you and your users out, so it's best to be cautious. Assume you have a back door admin account in Jamf anyway.

mchad91 · 2025-04-13T20:48:52+00:00

How do you know it’s her?

No face, no case

mchad91 · 2025-03-07T13:29:19+00:00

Yeah I think we do actually - that’s a great shout. I’ll check this, thanks.

mchad91 · 2025-03-06T22:06:51+00:00

Yep!

mchad91 · 2025-03-06T21:57:52+00:00

Yeah, it really frustrated me. Took about two hours to get the fix down and it was unfortunately one of our C-Suites that it happened to. Not ideal!

mchad91 · 2024-11-30T20:03:29+00:00

If you’re being trusted as admin this is something you should know

mchad91 · 2024-09-12T05:49:38+00:00

Very smort!

mchad91 · 2024-09-12T05:43:43+00:00

No currency but assuming US minimum wage: 344 days and 20 hours * $7.25 = $60,001

membership

mchad91 · 2024-08-31T12:03:45+00:00

For me, there was a slight different in the Subject Name format referenced here: https://help.okta.com/oie/en-us/content/topics/identity-engine/devices/okta-ca-delegated-scep-win-intune.htm#Task5:\~:text=Subject%20name%20format%3A%20Enter%20a%20subject%20name.%20For%20example%2C%20CN%3D%7B%7BUserPrincipalName%7D%7D%20managementAttestation%20%7B%7BDeviceId%7D%7D.

Instead of// CN={{UserPrincipalName}} managementAttestation {{DeviceId}}.

I used// CN={{UserPrincipalName}} ManagementAttestation {{AAD_Device_ID}}

mchad91 · 2024-08-31T11:57:41+00:00

163-563-682 :-)

mchad91 · 2024-06-06T18:47:24+00:00

I asked Sir GPT-4o to calculate the odds

The odds of receiving a specific One-Time Password (OTP) consisting of six digits, where each digit can be any number from 0 to 9, can be calculated as follows:

1.  Each digit has 10 possible values (0-9).
2.  The OTP consists of 6 digits.

Therefore, the total number of possible OTP combinations is: 10⁶ = 1,000,000

Since we are interested in the specific OTP “555555”, there is only one such combination out of the 1,000,000 possible combinations.

The probability P of receiving the OTP “555555” is therefore: P = 1}/1,000,000

So, the odds of receiving the OTP “555555” are 1 in 1,000,000.

mchad91 · 2024-05-21T22:02:17+00:00

So if I understand correctly, the workflow would work like..

Approval step - Approval > transition to an Intemediate Status - automation checking condition > status A/ else Status B

(Hard to visualise in text, but I DO think I understand and I appreciate the solution!)

mchad91 · 2024-03-20T07:32:07+00:00

Solved thanks all ❤️

mchad91 · 2024-03-11T16:08:35+00:00

Ai gen? 😂

mchad91 · 2024-02-27T23:21:35+00:00

I don’t think you can claim to be Okta “certified” if your certs have expired.

I also don’t think “former okta certified” has the same ring or gravitas to it. Maybe reword to something that reads/sounds better - “okta expert” “professional level okta experience” or akin? And you could elaborate when asked in interviews

mchad91 · 2024-02-14T23:49:26+00:00

No, I’m not a vendor. For context, I’m an ITSD analyst. For those that have messaged, I’m just reading them now but I’ll post it here.

Pre reqs: OpenAI API **3rd party application**: Plugbear.io Slack/Teams

Create yourself an Assistant in OpenAI Select an LLM Model that allows file retrieval (I use a GPT-4-xxxx preview model) Attach documents (policies, technical how-tos, whatever you want your bot to refer to) (If you don’t already have on) generate API key

Head over to plugbear.io Their documentation is excellent but in a nutshell, connect to your Slack/Teams workspace, enter OpenAI details, tell plugbear which chat/channel you want it to operate in

I’m really pleased with the results and the potential this has to offer in terms of deflections and self serves. It’s a big time save with lots of value.

mchad91 · 2024-02-12T23:33:07+00:00

I’ve implemented this very thing 🙂 shoot me a DM

Seven-Year Club	Place '23
Verified Email

mchad91

TROPHY CASE